Ips; Configuring Ips Logging And Alert Email - Fortinet FortiGate FortiGate-1000A Administration Manual

FortiGate-1000A/FA2 Administration Guide Version 2.80 MR11

IPS

FortiGate-1000A/FA2 Administration Guide
The FortiGate Intrusion Prevention System (IPS) combines signature and anomaly
intrusion detection and prevention with low latency and excellent reliability. The
FortiGate unit can record suspicious traffic in logs, can send alert email to system
administrators, and can log, pass, drop, reset, or clear suspicious packets or
sessions. You can adjust some IPS anomaly thresholds to work best with the normal
traffic on the protected networks. You can also create custom signatures to customize
the FortiGate IPS for diverse network environments.
You can configure the IPS globally and then enable or disable all signatures or all
anomalies in individual firewall protection profiles.
and where to configure and access them. To access protection profile IPS options go
to Firewall > Protection Profile, select edit or Create New, and select IPS. See
"Protection profile options" on page
Table 31: IPS and Protection Profile IPS configuration
Protection Profile IPS options
IPS Signature
Enable or disable IPS signatures for all
network services.
IPS Anomaly
Enable or disable IPS anomalies for all
network services.
Protection profile configuration
For information about adding protection profiles to firewall policies, see
protection profile to a policy" on page

Configuring IPS logging and alert email

Whenever the IPS detects or prevents an attack, it generates an attack message. You
can configure the FortiGate unit to add the message to the attack log and to send an
alert email to administrators. You can configure how often the FortiGate unit sends
alert email. You can also reduce the number of log messages and alerts by disabling
signatures for attacks that your system is not vulnerable to (for example, web attacks
when you are not running a web server). For more information on FortiGate logging
and alert email, see "Log & Report" on page
01-28011-0254-20051115
Table 31
239.
IPS setting
IPS > Signature
View and configure a list of predefined
signatures.
Create custom signatures based on the
network requirements.
IPS > Anomaly
View and configure a list of predefined
anomalies.
245.
361.
describes the IPS settings
"To add a
293